From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1757405AbXJYJGg (ORCPT ); Thu, 25 Oct 2007 05:06:36 -0400 Received: (majordomo@vger.kernel.org) by vger.kernel.org id S1754075AbXJYJGN (ORCPT ); Thu, 25 Oct 2007 05:06:13 -0400 Received: from cantor2.suse.de ([195.135.220.15]:34385 "EHLO mx2.suse.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754029AbXJYJGL (ORCPT ); Thu, 25 Oct 2007 05:06:11 -0400 Date: Thu, 25 Oct 2007 09:31:02 +0200 Message-ID: From: Takashi Iwai To: mgross@linux.intel.com Cc: linux-kernel@vger.kernel.org, torvalds@linux-foundation.org, anil.s.keshavamurthy@intel.com Subject: Re: [PATCH] intel-iommu: Fix array overflow In-Reply-To: <20071024233037.GA18079@linux.intel.com> References: <20071024233037.GA18079@linux.intel.com> User-Agent: Wanderlust/2.15.5 (Almost Unreal) SEMI/1.14.6 (Maruoka) FLIM/1.14.7 (=?ISO-8859-4?Q?Sanj=F2?=) APEL/10.6 MULE XEmacs/21.5 (beta28) (fuki) (+CVS-20070806) (i386-suse-linux) MIME-Version: 1.0 (generated by SEMI 1.14.6 - "Maruoka") Content-Type: text/plain; charset=ISO-8859-7 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org X-Mailing-List: linux-kernel@vger.kernel.org At Wed, 24 Oct 2007 16:30:37 -0700, Mark Gross wrote: > > On Tue, Oct 23, 2007 at 10:57:51AM +0200, Takashi Iwai wrote: > > Fix possible array overflow: > > > > drivers/pci/intel-iommu.c: In function ¡dmar_get_fault_reason¢: > > drivers/pci/intel-iommu.c:753: warning: array subscript is above array bounds > > drivers/pci/intel-iommu.c: In function ¡iommu_page_fault¢: > > drivers/pci/intel-iommu.c:753: warning: array subscript is above array bounds > > > > Signed-off-by: Takashi Iwai > > > > --- > > drivers/pci/intel-iommu.c | 4 ++-- > > 1 file changed, 2 insertions(+), 2 deletions(-) > > > > diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c > > index b3d7031..e4b0a0d 100644 > > --- a/drivers/pci/intel-iommu.c > > +++ b/drivers/pci/intel-iommu.c > > @@ -749,8 +749,8 @@ static char *fault_reason_strings[] = > > > > char *dmar_get_fault_reason(u8 fault_reason) > > { > > - if (fault_reason > MAX_FAULT_REASON_IDX) > > - return fault_reason_strings[MAX_FAULT_REASON_IDX]; > > + if (fault_reason >= MAX_FAULT_REASON_IDX) > > + return fault_reason_strings[MAX_FAULT_REASON_IDX - 1]; > > This looks like what the code meant to implement. I think not. The size of fault_reason_strings[] is MAX_FAULT_REASON_IDX, not + 1. So gcc warning is correct. Maybe the main problem is that the constant name is confusing... Takashi > I guess future > hardware may be able to generate more types of faults, otherwise I'd put > a BUG here. > > --mgross > > > > else > > return fault_reason_strings[fault_reason]; > > } > > - > > To unsubscribe from this list: send the line "unsubscribe linux-kernel" in > > the body of a message to majordomo@vger.kernel.org > > More majordomo info at http://vger.kernel.org/majordomo-info.html > > Please read the FAQ at http://www.tux.org/lkml/ >